PT-2018-13445 · Ipfire · Ipfire

Reginald Dodd · Publicado 2018-10-17 · Atualizado 2019-10-03 · CVE-2018-16232

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IPFire Firewall versions prior to 2.21 Core Update 124

Description An authenticated command injection issue exists in the backup.cgi page, allowing an authenticated user with privileges for the affected page to execute arbitrary commands.

Recommendations For versions prior to 2.21 Core Update 124, update to version 2.21 Core Update 124 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup.cgi page to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-16232

Produtos afetados

Ipfire

Referências · 4

• 🔥 https://doddsecurity.com/213/command-injection-on-ipfire-firewalls · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16232 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16232 · Aviso do Fabricante
• https://ipfire.org/news/ipfire-2-21-core-update-124-released · Aviso do Fabricante